York Financial Assistance Scheme (YFAS) City of York Council Internal Audit Report 2015-16

Business Unit: Customer & Business Support Services Responsible Officer: Head of Customer, Resident & Exchequer Services Service Manager: Benefits Transactional Team Manager Date Issued: 26th May 2016 Status: Final Reference: 10320/010

| Actions | P1 | P2 | P3 | |---------|----|----|----| | Overall Audit Opinion | Substantial Assurance | Summary and Overall Conclusions

Introduction The York Financial Assistance Scheme (YFAS) is a scheme organised by the council to provide urgent assistance following an emergency or to support vulnerable adults move into or remain in the community. The scheme has a budget of £665k and since 1st April 2015 there have been nearly 600 applications to the scheme.

Objectives and Scope of the Audit The purpose of this audit was to provide assurance to management that procedures and controls within the scheme will ensure that:

- There are effective guidance documents available to determine whether applications are successful and how much money can be paid to claimants.
- Applications are approved or rejected in line with the documented criteria.
- Payments are authorised by a suitable person.
- The grants are spent on suitable items in line with the guidance.
- The store vouchers that are given to successful claimants are kept in a secure location.

Key Findings The procedures for managing the YFAS scheme were generally found to be working satisfactorily. The guidance documents to assist were on the internet and contained all the necessary details to help applicants apply for grants on the YFAS scheme. The process for making applications to YFAS was working well except that evidence was not always being kept to support decisions to approve or reject the applications. It was also noted that users in the Benefits Transactional team could both create and approve applications up to certain values with no spot checks being done to identify instances where YFAS grants were awarded inappropriately.

The security procedures for storing unused vouchers relating to the YFAS scheme were reviewed with no serious security breached being noted.

Overall Conclusions It was found that the arrangements for managing risk were good with few weaknesses identified. An effective control environment is in operation, but there is scope for further improvement in the areas identified. Our overall opinion of the controls within the system at the time of the audit was that they provided Substantial Assurance. 1 Creating and authorising YFAS applications

| Issue/Control Weakness | Risk | |------------------------|------| | Staff in the Benefits Transactional Team can both create and authorise low level payments from the YFAS scheme. No subsequent spot checks are carried out. | YFAS grants are paid out inappropriately. |

Findings

The details of the application are entered onto the YFAS portal on the Northgate benefits system with the application then being approved or rejected on this system by the YFAS assessor on duty. The application is then sent for payment unless it is over £500 for emergency and £1,500 for community payments when a second authorisation is needed.

Currently there are 36 members of the Benefits Transactional team that have access to both create and then approve YFAS applications.

Whilst it is accepted that it may be too onerous to require a second authorisation for all applications, spot checks could be subsequently carried out to confirm that the decision made to approve or reject the application was correct.

Agreed Action 1.1

YFAS claims will become part of the Quality Assurance process from 31/05/16. This is following the reintegration of the YFAS duty into the benefit transactional team. Technical Officers will perform random quality checks each week on YFAS claims, ensuring that each team member has some checks per month. These will look at quality, accuracy and decision making to ensure we are processing awards within the YFAS guidelines. We are in the process of devising a checking sheet to record the checks.

| Priority | 2 | |----------|---| | Responsible Officer | Benefits Transactional Team Manager | | Timescale | 31/05/16 |

### 2 The lack of evidence to support decisions to approve YFAS applications

| Issue/Control Weakness | Risk | |------------------------|------| | Evidence to support decisions to approve YFAS applications was not always kept. | It is not possible to confirm whether decisions made to approve YFAS applications were made correctly. |

#### Findings

A sample of ten successful and unsuccessful applications to the YFAS scheme was taken to confirm the decision was appropriate. Although no inappropriate decisions were noted there was not always evidence kept on the case file to support this decision which was noted in five approved cases. Three of the five approved decisions didn't contain the evidence obtained from the DWP to support the decision. The other two cases were due to domestic circumstances with no evidence obtained from a support worker to confirm that the basis of the application was correct.

#### Agreed Action 2.1

As mentioned in action 1.1, Quality Checks will become part of the YFAS process and awards will be checked to ensure evidences and accurate notes are being kept to support decisions made. These will be recorded on a new YFAS Quality Assurance recording sheet.

| Priority | Responsible Officer | Timescale | |----------|---------------------|-----------| | 3 | Benefits Transactional Team Manager | 31/05/16 |

### 3 Access to the YFAS section of the Northgate system

| Issue/Control Weakness | Risk | |------------------------|------| | There are an excessive number of users to the YFAS area of the Northgate system. | YFAS applications are processed by unauthorised personnel. |

#### Findings

There are currently 48 users with access to the YFAS area of the Northgate system. Of these users 36 work in the Benefits Transactional Team and 9 in the ICT team. These users can often perform multiple tasks on the system including create and authorising YFAS applications.

#### Agreed Action 3.1

The user list and access levels for all users have been reviewed and changes have been applied. All transactional team members have remained unchanged as their access levels are correct for the access they require. The front end CSR’s have had their access reduced so that they are no longer able to authorise YFAS awards. Their access now represents the access levels that they require to perform their YFAS duties. I have contacted the ICT team who have confirmed that they require the nine users to have access to the system so that the team can create new users when requested. The majority of access rights for staff in the ICT team are for admin tasks only, meaning they are not able to authorise payments.

| Priority | 3 | |----------|---| | Responsible Officer | Benefits Transactional Team Manager | | Timescale | 30/06/16 |

### Findings

The procedures for storing vouchers were reviewed with only one short-coming being noted. xx.

### Agreed Action 4.1

| Priority | 3 | |----------|---| | Responsible Officer | Customer Service Contact Team Manager | | Timescale | 30/09/16 | Audit Opinions and Priorities for Actions

Audit Opinions

Audit work is based on sampling transactions to test the operation of systems. It cannot guarantee the elimination of fraud or error. Our opinion is based on the risks we identify at the time of the audit.

Our overall audit opinion is based on 5 grades of opinion, as set out below.

| Opinion | Assessment of internal control | |--------------------|------------------------------------------------------------------------------------------------| | High Assurance | Overall, very good management of risk. An effective control environment appears to be in operation. | | Substantial Assurance | Overall, good management of risk with few weaknesses identified. An effective control environment is in operation but there is scope for further improvement in the areas identified. | | Reasonable Assurance | Overall, satisfactory management of risk with a number of weaknesses identified. An acceptable control environment is in operation but there are a number of improvements that could be made. | | Limited Assurance | Overall, poor management of risk with significant control weaknesses in key areas and major improvements required before an effective control environment will be in operation. | | No Assurance | Overall, there is a fundamental failure in control and risks are not being effectively managed. A number of key areas require substantial improvement to protect the system from error and abuse. |

Priorities for Actions

| Priority | Description | |----------|-----------------------------------------------------------------------------| | Priority 1 | A fundamental system weakness, which presents unacceptable risk to the system objectives and requires urgent attention by management. | | Priority 2 | A significant system weakness, whose impact or frequency presents risks to the system objectives, which needs to be addressed by management. | | Priority 3 | The system objectives are not exposed to significant risk, but the issue merits attention by management. | Where information resulting from audit work is made public or is provided to a third party by the client or by Veritau then this must be done on the understanding that any third party will rely on the information at its own risk. Veritau will not owe a duty of care or assume any responsibility towards anyone other than the client in relation to the information supplied. Equally, no third party may assert any rights or bring any claims against Veritau in connection with the information. Where information is provided to a named third party, the third party will keep the information confidential.